topic Re: How do I fill nulls in time series data without using timechart? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280673#M84695 <P>wow, hod no idea it was so easy! thanks</P> Fri, 12 Feb 2016 21:43:48 GMT jedatt01 2016-02-12T21:43:48Z How do I fill nulls in time series data without using timechart? https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280671#M84693 <P>I have time series data that I want to bucket into 15 minute chunks with corresponding counts like so....</P> <PRE><CODE>mysearch | bucket span=15m _time | stats count by groups _time </CODE></PRE> <P>What I need next is for every value of groups that is null for a particular time bucket to be replaced with a 0</P> <P>Basically I need the functionality of a timechart but I need to keep the groups field intact instead of each value of groups being split out into it's own field</P> <P>This is what I would like my output table to look like:</P> <P>_time | groups | count<BR /> 10:00 am | group1 | 75<BR /> 10:00 am | group2 | 0<BR /> 10:00 am | group3 | 16<BR /> 10:15 am | group1 | 14<BR /> 10:15 am | group2 | 15<BR /> 10:15 am | group3 | 0<BR /> 10:30 am | group1 | 0<BR /> 10:30 am | group2 | 105<BR /> 10:30 am | group3 | 24<BR /> 10:45 am | group1 | 1<BR /> 10:45 am | group2 | 0 <BR /> 10:45 am | group3 | 75</P> Fri, 12 Feb 2016 21:25:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280671#M84693 jedatt01 2016-02-12T21:25:22Z Re: How do I fill nulls in time series data without using timechart? https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280672#M84694 <P>Try something like this</P> <PRE><CODE>your base search | timechart span=15m count by groups limit=100 | untable _time groups count </CODE></PRE> Fri, 12 Feb 2016 21:36:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280672#M84694 somesoni2 2016-02-12T21:36:15Z Re: How do I fill nulls in time series data without using timechart? https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280673#M84695 <P>wow, hod no idea it was so easy! thanks</P> Fri, 12 Feb 2016 21:43:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-fill-nulls-in-time-series-data-without-using-timechart/m-p/280673#M84695 jedatt01 2016-02-12T21:43:48Z